An exploit for the bypass vulnerability required an HTTP parameter pollution in a web application.
Source: Threadpost